ResearchAuthenticated Workflows: A Systems Approach to Protecting Agentic AIRead on arXiv
MACAW
ConsoleGet started

AI Controls · Deterministic controls for autonomous agents

Deterministic controls for autonomous agents.

Identity, policy, authorization and signed evidence at the boundaries where agents act, decided before anything executes.

See it in actionGet started

Get startednpm install -g macaw-ai && macaw-ai install

  • Signed
  • Allowed
  • Attested
  • Denied

Works with

  • Anthropic
  • OpenAI
  • LangChain
  • LiteLLM
  • Pydantic AI
  • MCP
  • MCP 2.0
  • A2A
  • OpenClaw
  • Claude Code
  • Codex
  • Gemini CLI
  • Auth0
  • Okta
  • Azure / Entra ID
  • Google
  • Keycloak
  • OpenTelemetry
  • Datadog
  • Grafana
  • Elastic
  • Splunk
  • AWS CloudWatch

Yesterday you worried about what the LLM said.
Now you worry about what it did.

$2.1M

Per incident estimate of added costs from compliance fines, lost customers, operational downtime and rework.

65%

of enterprises report agents acting outside their intended scope.

1 in 10

have controls for the agents they have deployed. The rest use custom guardrails, or assume a security vendor has it covered.

Motivated agents work around their limits.

Escalations in 2026.

  1. February

    A malicious link hands over an agent’s gateway. Any website can silently hijack a locally running agent.

    CVE-2026-25253, ClawJacked (Oasis Security)
  2. March

    TeamPCP poisons LiteLLM on PyPI. Days later, Axios on npm is hijacked.

    TeamPCP, UNC1069
  3. July

    OpenAI’s own test agents escape their sandbox and spend about two and a half days inside Hugging Face production.

    OpenAI and Hugging Face disclosures
  4. August

    No attacker at all. An agent cancels a stranger’s reservation to reach its goal.

    ABC News
Instruction. Not attack. In compliance.Asked for 20K past a 10K limit, the agent works around it in +5K updates.September 2026

Today, AI has point controls.

Current solutions like alignment, security and guardrails cannot guarantee control. So every enterprise we meet is building its own.

Hover or tap a layer to see why it lets the action through.

  • 1. Observability: reactive. The horse has already left.
  • 2. Identity and gateways: basically IAM. Checks the driver, not the passengers.
  • 3. Model filters: probabilistic. A model judging a model.
  • 4. Vendor-native controls: vendor lock-in. Enterprises want multi-vendor.
  • 5. Alignment and evals: tests before. Watches after. Not during the action.

Buy all five. Stitch them together. The agent still escapes.

Enumeration will always be a losing proposition. MACAW reasons about effects and enforces deterministically.

Alignment is a property of the model. Control is a property of the system.

AI Controls answer four questions before every action.

Who can act?
Identity
What may it do?
Policy
Who authorized it?
Approval
Can you prove it?
Signed evidence

Protocol. Every operation is signed, and every callee verifies it independently, so no hop has to trust the one before it.

AI Controls in action.

Developers · Coding agents · 3:03Deterministic controls for Claude Code.

Claude Code is told to force-delete a file, then to fetch a URL. Policy denies the deletion; the fetch waits for a person to approve it, then runs.

What you’re seeing

10 demos

All use cases

34M+ attacks. Zero escapes.

Bypass requires breaking cryptography, not clever prompting.

Attacks from our validator and internal testing.

Public benchmark · AgentDojo

0 of 949 attacks took effect. Even when the agent obeyed every one.

Without MACAW, gpt-4o carried out 184 of 389. Through MACAW, none. No task lost to a refusal.

How we measured it
gpt-4o on AgentDojo v1.2.2: attacked runs where the attacker’s action took effect.

Enforce where your agents act.

Beside your coding agent, in your code, or in front of your MCP servers.

Beside your coding agent

Coding agents

Claude Code and Codex. See what your agent did, then decide what it may do.

$ rm -rf ./build
denied · deletes files
$ curl -s api.partner.dev
approved by bob · ran

In front of your MCP servers

SecureMCP Store

51 MCP servers. Every call checked against your policy first.

SnowflakeGitHubDatabricksPostgreSQLNotionStripe+45

In your code

SecureAI adapters

One import. Same code. OpenAI, Anthropic, LangChain and more, plus the SDK.

- client = OpenAI()
+ client = SecureOpenAI()
same calls · signed · checked

One control plane

Platform

Policy, approvals and evidence for all three, in one console. Hosted, in your VPC or on-prem.

execute_sql · mcp:lakehouse
held → manager_approved
signed · log verifies

Shipping in production today.

Tenants
100+
Agents
50K+
Policies
500+
Events and audit records
Millions

Since May 2026, from tenants that shared telemetry.

Get startedTalk to us

Docs

Install and make your first checked call in five minutes.

All docs
For agentsIf you’re an agent reading this, start at /llms.txt.